Simplified deployment of e-securemail for Microsoft 365

    This article outlines the secure deployment procedure dedicated to your Microsoft 365 email service.
    The settings will be applied by running a PowerShell Script downloaded from your console.
    Note: This configuration applies only to email environments that are not in a hybrid setup.


    Simply follow the 4 steps below.

     ⚠️ "To ensure the successful delivery of your emails and avoid any loss, please follow each step of the procedure in order. MX changes must be made as the final step."
      

    1. Define the Destination Mail Server :

    To deliver filtered messages to Microsoft 365, enter the mail server of the relevant domain.

    For example: yourdomain-com.mail.protection.outlook.com.

    1. Log in to the domain management interface at: https://www.security-mail.net/
    2. Enter your username and password.
    3. Navigate to (Configuration => Domain Settings => Delivery/SMTP) and update the destination mail server (your Microsoft 365 server).

    2. Modify DNS records (SPF, DKIM & DMARC) :

    To legitimize email sending through e-securemail servers, you will need to add:


    Ajout de l’enregistrement SPF

    The SPF record is a line you need to add to your DNS server to prevent email spoofing. This helps reduce the risk of your domain being used for SPAM.

    Here is the information you need to add through your registrar (e.g., Gandi, 1&1, OVH) to create the TXT record for the domain "your-domain-name.com".

    (Note: "your-domain-name.com" is a domain name we will use as an example.)

    your-domain-name.com 10800 IN TXT "v=spf1 include:includespf.security-mail.net -all"


    Adding the DKIM Record

    The DKIM record ensures that your domain has not been spoofed and that the message has not been altered during transmission.

    1. Generate your DKIM key:

      • Log in to the e-securemail interface.
      • Navigate to Configuration > Domain Settings > DKIM.

    2. Add the DKIM key to your domain’s DNS records:

      • Name: sec-sig-email._domainkey
      • TTL: 3600
      • Format: TXT


    Adding the DMARC Record

    The DMARC record specifies how a domain should handle emails failing SPF and DKIM checks, providing protection against spoofing and phishing by indicating whether messages should be accepted, quarantined, or rejected.

    1. Generate a DMARC record:

    2. Example DMARC Record:
      Below is an example of a DMARC record for the domain example.com that uses the policy "none" and sends reports to the email address dmarc@secuserve.com:

    v=DMARC1; p=none; rua=mailto:dmarc@secuserve.com

    This ensures proper email authentication and reporting while protecting your domain from abuse.

    3. Automated deployment :

    "Make sure you have the necessary rights to make changes at the relevant tenant domain level".
    This step is essential for the deployment of advanced features such as 'Remediation' and 'Junk Mail in Microsoft Outlook', as well as outbound relaying/filtering.


    Access the script:
    Log in to your e-securemail interface at https://www.security-mail.net/, select the relevant domain (from your list of domains), then go to Administration > Office 365 and choose Automatic. 


    Choose the domain to configure.

    Active: Spam will be sent directly to the Junk folder in Microsoft 365 (You will not receive quarantine reports).

    Inactive: Spam will be sent to the e-securemail quarantine (You will receive quarantine reports).

    Enter the email address of the Microsoft Admin account, then click Download.



    Run the file with PowerShell as Administrator.

    A Microsoft authentication prompt will appear; log in with the Microsoft Admin account.


    IMPORTANT: this configuration does not apply to a hybrid environment.


    Go back to the Administration > Office 365 page, then click Confirm.

    4. Modify DNS records (MX) :

    Once the destination mail server is updated, configure the MX records to redirect traffic to our gateways.

    This reduces the attack surface on your Microsoft 365 mailboxes. Update the MX records with the following information:


    MX :

    Priority     Mailing Server

    10             france.security-mail.net.

    20             europe.security-mail.net.

    Some registrars require you to add a DOT after the .net to complete the registration.

    Tags
    Déploiement en un clic esm for 365 Déploiement pour Microsoft 365 Déploiement simple Déploiement simplifié Configuration secuserve Enregistrement DNS Tenant Microsoft 365 MX DKIM SPF DNS Configuration messagerie
    Published